[vite-plugin] fix: resolve temp dir to long form in E2E tests (Windows)#14140
Merged
Conversation
Vite 8.0.16 (and the v6/v7 backports) rejects paths containing `~` or `:` as a security fix for GHSA-fx2h-pf6j-xcff (path traversal via NTFS Alternate Data Streams and Windows 8.3 short names — see vitejs/vite#22572). On Windows GitHub Actions runners, `os.tmpdir()` returns `C:\Users\RUNNER~1\AppData\Local\Temp` (the 8.3 short form of `runneradmin`), so every fixture path created under it now fails Vite's new check, causing every Windows E2E test to fail immediately with `Failed to load url /api/index.ts` during dev server startup. Resolving the temp dir via `fs.realpath()` expands the short name to its long form before `fs.mkdtemp()`, which Vite accepts. No behaviour change on macOS/Linux.
|
Contributor
|
LGTM |
workers-devprod
requested review from
a team and
james-elicx
and removed request for
a team
Contributor
|
Codeowners approval required for this PR:
Show detailed file reviewers |
dario-piotrowicz
approved these changes
Jun 1, 2026
workers-devprod
approved these changes
Jun 1, 2026
Contributor
workers-devprod
left a comment
workers-devprod
left a comment
There was a problem hiding this comment.
Codeowners reviews satisfied
create-cloudflare
@cloudflare/deploy-helpers
@cloudflare/kv-asset-handler
miniflare
@cloudflare/pages-shared
@cloudflare/unenv-preset
@cloudflare/vite-plugin
@cloudflare/vitest-pool-workers
@cloudflare/workers-editor-shared
@cloudflare/workers-utils
wrangler
@cloudflare/wrangler-bundler
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No tracking issue; surfaced via the Windows Vite Plugin E2E job spiking to ~100% failure rate on 2026-06-01.
Vite 8.0.16 (published 2026-06-01 09:50 UTC) and its v6/v7 backports introduced a security fix (vitejs/vite#22572, GHSA-fx2h-pf6j-xcff) that rejects paths containing
~or:to prevent path traversal via NTFS Alternate Data Streams and Windows 8.3 short names.On Windows GitHub Actions runners,
os.tmpdir()returns:(
RUNNER~1is the 8.3 short form ofrunneradmin.) Our Vite plugin E2E suite seeds every fixture under that path viafs.mkdtemp(path.join(os.tmpdir(), "vite-plugin-"))ine2e/global-setup.ts, so every Windows E2E test now fails immediately with:Counts at the time of writing:
*the "passes" on Jun 1 after the regression are turbo remote-cache hits, not real runs.
This change resolves the temp dir to its real long-form path with
fs.realpath()before passing it tofs.mkdtemp(). The expanded path no longer contains~, so Vite accepts it. No behaviour change on macOS/Linux (whererealpath(os.tmpdir())either returns the same path or follows the/var→/private/varsymlink on macOS, which is the correct full path anyway).This matches the existing pattern in
packages/workers-utils/src/test-helpers/run-in-tmp.ts, which already wrapsmkdtempSyncinrealpathSync.